diff --git a/net/freeipa-server/Makefile b/net/freeipa-server/Makefile index 6567e1379110..e86badffca7e 100644 --- a/net/freeipa-server/Makefile +++ b/net/freeipa-server/Makefile @@ -1,150 +1,164 @@ PORTNAME= freeipa-server DISTVERSION= 4.13.2 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= net MASTER_SITES= https://codeberg.org/freeipa/freeipa/releases/download/release-${DISTVERSION:S/./-/g}/ DISTNAME= freeipa-${DISTVERSION} MAINTAINER= joneum@FreeBSD.org COMMENT= FreeIPA server WWW= https://www.freeipa.org/ LICENSE= GPLv3+ LICENSE_FILE= ${WRKSRC}/COPYING BUILD_DEPENDS= ${LOCALBASE}/bin/getopt:misc/getopt \ ${LOCALBASE}/libdata/pkgconfig/dirsrv.pc:net/389-ds-base \ ${LOCALBASE}/libdata/pkgconfig/sss_idmap.pc:security/sssd2 \ ${PY_SETUPTOOLS} \ ${PYTHON_PKGNAMEPREFIX}lesscpy>0:www/py-lesscpy@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}pip>0:devel/py-pip@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}rjsmin>0:archivers/py-rjsmin@${PY_FLAVOR} \ bash:shells/bash LIB_DEPENDS= libcurl.so:ftp/curl \ libini_config.so:devel/ding-libs \ libintl.so:devel/gettext-runtime \ libjansson.so:devel/jansson \ libkrad.so:security/krb5 \ libnspr4.so:devel/nspr \ libpopt.so:devel/popt \ libpwquality.so:security/libpwquality \ libsasl2.so:security/cyrus-sasl2 \ libsss_nss_idmap.so:security/sssd2 \ libtalloc.so:${SAMBA_TALLOC_PORT} \ libtevent.so:${SAMBA_TEVENT_PORT} \ libunistring.so:devel/libunistring \ libuuid.so:misc/libuuid \ libxmlrpc.so:net/xmlrpc-c RUN_DEPENDS= ${LOCALBASE}/bin/chronyc:net/chrony \ ${LOCALBASE}/libexec/apache24/mod_auth_gssapi.so:www/freeipa-auth-gssapi \ ${LOCALBASE}/libexec/apache24/mod_deflate.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_expires.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_lookup_identity.so:www/mod_lookup_identity \ ${LOCALBASE}/libexec/apache24/mod_proxy.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_proxy_ajp.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_proxy_http.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_rewrite.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_session.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_session_cookie.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_ssl.so:www/apache24 \ ${LOCALBASE}/libexec/apache24/mod_wsgi.so:www/mod_wsgi@${PY_FLAVOR} \ ${LOCALBASE}/sbin/certmonger:security/certmonger \ ${LOCALBASE}/sbin/gssproxy:security/gssproxy \ ${LOCALBASE}/sbin/httpd:www/apache24 \ ${LOCALBASE}/sbin/oddjobd:sysutils/oddjob \ ${PYTHON_PKGNAMEPREFIX}dbus>0:devel/py-dbus@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}gssapi>0:security/py-gssapi@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}ifaddr>0:net/py-ifaddr@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}jwcrypto>0:security/py-jwcrypto@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}kdcproxy>0:security/py-kdcproxy@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}lib389>=0:net/py-lib389@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}netaddr>0:net/py-netaddr@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}python-augeas>0:textproc/py-python-augeas@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}python-dateutil>0:devel/py-python-dateutil@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}qrcode>0:textproc/py-qrcode@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}sqlite3>0:databases/py-sqlite3@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}urllib3>0:net/py-urllib3@${PY_FLAVOR} \ 389-ds-base>=0:net/389-ds-base \ dogtag-pki>0:security/dogtag-pki \ slapi-nis>=0.70.0:net/slapi-nis \ sssd2>=2.13.1_2:security/sssd2 USES= autoreconf gettext-runtime gettext-tools gmake gssapi:mit iconv \ ldap libtool localbase:ldflags nodejs:build pkgconfig python \ samba shebangfix ssl USE_RC_SUBR= ipa-custodia freeipa-server SHEBANG_FILES= install/ui/util/build.sh install/ui/util/change-profile.sh \ install/ui/util/clean.sh install/ui/util/compile.sh \ install/ui/util/make-builder.sh install/ui/util/make-dojo.sh \ install/ui/util/make-patternfly.sh install/ui/util/make-ui.sh \ install/ui/util/prepare-dojo.sh install/ui/util/sync.sh GNU_CONFIGURE= yes CONFIGURE_ARGS= --disable-client \ --with-ipaplatform=freebsd \ --with-vendor-suffix=+FreeBSD CONFIGURE_ENV= LIBS="-lintl" \ LIBVERTO_CFLAGS="-I${LOCALBASE}/include" \ LIBVERTO_LIBS="-L${LOCALBASE}/lib -lverto" CFLAGS+= -D__BSD_VISIBLE=1 CONFLICTS_INSTALL= freeipa-client BINARY_ALIAS= getopt=${LOCALBASE}/bin/getopt SUB_FILES= ipa-otpd-wrapper SUB_LIST+= PYTHON_CMD=${PYTHON_CMD} USERS= ipaapi kdcproxy GROUPS= ipaapi kdcproxy PLIST_SUB= DISTVERSION=${DISTVERSION} OPTIONS_DEFINE= DOCS +post-patch: + @${REINPLACE_CMD} -e 's|%%PREFIX%%|${PREFIX}|g' \ + -e 's|%%LOCALBASE%%|${LOCALBASE}|g' \ + ${WRKSRC}/client/ipa-join.c \ + ${WRKSRC}/install/share/ipa-kdc-proxy.conf.template \ + ${WRKSRC}/install/tools/ipa-httpd-kdcproxy.in \ + ${WRKSRC}/install/updates/80-schema_compat.update \ + ${WRKSRC}/ipaplatform/base/paths.py \ + ${WRKSRC}/ipaplatform/freebsd/paths.py \ + ${WRKSRC}/ipaplatform/freebsd/services.py \ + ${WRKSRC}/ipapython/ipautil.py \ + ${WRKSRC}/ipaserver/install/cainstance.py \ + ${WRKSRC}/ipaserver/install/server/upgrade.py + post-build: ${MAKE_CMD} -C ${WRKSRC}/client \ LIBINTL_LIBS="-lintl" ipa-getkeytab ipa-rmkeytab ipa-join post-install: ${CHMOD} 0555 ${STAGEDIR}${PREFIX}/libexec/ipa/certmonger/* ${INSTALL_SCRIPT} ${WRKSRC}/client/ipa-client-install.in \ ${STAGEDIR}${PREFIX}/sbin/ipa-client-install @${REINPLACE_CMD} -e "1s|^#!/usr/bin/python3.*|#!${PYTHON_CMD} -I|" \ ${STAGEDIR}${PREFIX}/sbin/ipa-client-install @${RM} ${STAGEDIR}${PREFIX}/sbin/ipa-client-install.bak ${INSTALL_SCRIPT} ${WRKSRC}/client/ipa-client-automount.in \ ${STAGEDIR}${PREFIX}/sbin/ipa-client-automount @${REINPLACE_CMD} -e "1s|/usr/bin/python3|${PYTHON_CMD} -I|" \ ${STAGEDIR}${PREFIX}/sbin/ipa-client-automount @${RM} ${STAGEDIR}${PREFIX}/sbin/ipa-client-automount.bak ${INSTALL_PROGRAM} ${WRKSRC}/client/ipa-getkeytab \ ${STAGEDIR}${PREFIX}/sbin/ipa-getkeytab ${INSTALL_PROGRAM} ${WRKSRC}/client/ipa-rmkeytab \ ${STAGEDIR}${PREFIX}/sbin/ipa-rmkeytab ${INSTALL_PROGRAM} ${WRKSRC}/client/ipa-join \ ${STAGEDIR}${PREFIX}/sbin/ipa-join ${INSTALL_SCRIPT} ${WRKDIR}/ipa-otpd-wrapper \ ${STAGEDIR}${PREFIX}/libexec/ipa/ipa-otpd-wrapper @${MKDIR} ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d ${INSTALL_DATA} ${FILESDIR}/freeipa-server.newsyslog.conf \ ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d/freeipa-server.conf.sample @${MKDIR} ${STAGEDIR}/var/db/ipa-client/pki @${MKDIR} ${STAGEDIR}/var/db/ipa-client/sysrestore @${MKDIR} ${STAGEDIR}${PREFIX}/share/ipa/client ${INSTALL_DATA} ${WRKSRC}/client/share/freeipa.template \ ${STAGEDIR}${PREFIX}/share/ipa/client/freeipa.template ${INSTALL_DATA} ${WRKSRC}/client/share/freeipa-realm.template \ ${STAGEDIR}${PREFIX}/share/ipa/client/freeipa-realm.template post-install-DOCS-on: @${MKDIR} ${STAGEDIR}${DOCSDIR} ${INSTALL_DATA} ${FILESDIR}/README.md ${STAGEDIR}${DOCSDIR}/README.md .include diff --git a/net/freeipa-server/files/freeipa-server.in b/net/freeipa-server/files/freeipa-server.in index b06145da69f1..befcdbcab6be 100644 --- a/net/freeipa-server/files/freeipa-server.in +++ b/net/freeipa-server/files/freeipa-server.in @@ -1,100 +1,100 @@ #!/bin/sh # PROVIDE: freeipa_server # REQUIRE: LOGIN NETWORKING # KEYWORD: shutdown # # Add the following line to /etc/rc.conf to enable the FreeIPA server: # # freeipa_server_enable="YES" # # The whole stack (dirsrv, krb5kdc, kadmind, pki-tomcatd, httpd, custodia, # ipa-otpd) is orchestrated by IPA's own controller, ipactl. Enabling this # single service is enough; the back-end services are started via # "service onestart" and need no individual rc.conf entry. . /etc/rc.subr name="freeipa_server" desc="FreeIPA server control service" rcvar="freeipa_server_enable" load_rc_config "${name}" : ${freeipa_server_enable:="NO"} command="%%PREFIX%%/sbin/ipactl" ipa_config="%%PREFIX%%/etc/ipa/default.conf" extra_commands="prepare" prepare_cmd="${name}_prepare" start_precmd="${name}_prestart" start_cmd="${name}_start" stop_cmd="${name}_stop" restart_cmd="${name}_restart" status_cmd="${name}_status" freeipa_server_prepare() { /usr/bin/install -d -o root -g wheel -m 0711 /var/run/ipa /usr/bin/install -d -o ipaapi -g ipaapi -m 6770 /var/run/ipa/ccaches # mod_wsgi socket directory for httpd; must be traversable by the www # worker user so it can reach the /ipa WSGI daemon sockets (else 503). /usr/bin/install -d -o root -g wheel -m 0755 /var/run/httpd if [ ! -f /var/run/ipa/services.list ]; then /usr/bin/printf '[]\n' > /var/run/ipa/services.list /bin/chmod 0644 /var/run/ipa/services.list fi } freeipa_server_prestart() { # FreeIPA is not usable until ipa-server-install has run. if [ ! -f "${ipa_config}" ]; then warn "FreeIPA is not configured yet - run 'ipa-server-install' first" return 1 fi # FreeIPA requires a fully-qualified hostname that resolves to a real # address. A short name breaks Kerberos and Dogtag (certificate # hostname mismatch, wrong TLS-key passphrase lookup). _fqdn=$(/bin/hostname) case "${_fqdn}" in *.*) ;; *) warn "hostname '${_fqdn}' is not a FQDN - FreeIPA expects e.g. ipa.example.com" ;; esac freeipa_server_prepare } freeipa_server_start() { # Start the whole stack detached from the boot rc's session/process # group. FreeBSD job-control cleanup (killjobc) sends SIGHUP to the rc # process group when a boot subshell exits, and 389-ds (ns-slapd) treats # SIGHUP as a shutdown -- so the Directory Server would die ~10-20s into # the boot. daemon(8) puts ipactl, and thus every service it starts, # into its own session so that SIGHUP never reaches them. # --ignore-service-failures lets the stack come up even if the slow # Dogtag/Java CA times out on a cold boot. /usr/sbin/daemon -f "${command}" start --ignore-service-failures } freeipa_server_stop() { "${command}" stop } freeipa_server_restart() { - "${command}" restart + "${command}" restart --ignore-service-failures } freeipa_server_status() { "${command}" status } run_rc_command "$1" diff --git a/net/freeipa-server/files/patch-client_ipa-join.c b/net/freeipa-server/files/patch-client_ipa-join.c index 94f5f85cc117..fbb40dd36b1e 100644 --- a/net/freeipa-server/files/patch-client_ipa-join.c +++ b/net/freeipa-server/files/patch-client_ipa-join.c @@ -1,20 +1,20 @@ --- client/ipa-join.c.orig 2025-01-15 09:52:51 UTC +++ client/ipa-join.c @@ -1197,7 +1197,7 @@ join(const char *server, const char *hostname, const c if (childpid == 0) { char *argv[12]; - char *path = "/usr/sbin/ipa-getkeytab"; -+ char *path = "/usr/local/sbin/ipa-getkeytab"; ++ char *path = "%%PREFIX%%/sbin/ipa-getkeytab"; int arg = 0; int err; @@ -1372,7 +1372,7 @@ unenroll_host(const char *server, const char *hostname } krb5_cc_close(krbctx, ccache); ccache = NULL; - putenv("KRB5CCNAME=MEMORY:ipa-join"); + setenv("KRB5CCNAME", "MEMORY:ipa-join", 1); #ifdef WITH_IPA_JOIN_XML rval = xmlrpc_unenroll_host(ipaserver, hostname, quiet); diff --git a/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template b/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template index 70604cd4b10c..5eb7942bbe09 100644 --- a/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template +++ b/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template @@ -1,43 +1,43 @@ --- install/share/ipa-kdc-proxy.conf.template.orig 2025-01-15 09:52:51 UTC +++ install/share/ipa-kdc-proxy.conf.template @@ -1,29 +1,29 @@ # -# VERSION 2 - DO NOT REMOVE THIS LINE +# VERSION 4 - DO NOT REMOVE THIS LINE # # Kerberos over HTTP / MS-KKDCP support (Kerberos KDC Proxy) # -# The symlink from /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/ is maintained -# by the ExecStartPre script /usr/libexec/ipa/ipa-httpd-kdcproxy in -# httpd.service. The service also sets the environment variable -+# The symlink from /usr/local/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to -+# /usr/local/etc/apache24/Includes/ipa-kdc-proxy.conf is maintained by -+# /usr/local/libexec/ipa/ipa-httpd-kdcproxy in the apache24 RC start and ++# The symlink from %%LOCALBASE%%/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to ++# %%LOCALBASE%%/etc/apache24/Includes/ipa-kdc-proxy.conf is maintained by ++# %%PREFIX%%/libexec/ipa/ipa-httpd-kdcproxy in the apache24 RC start and +# restart hooks. The service also sets the environment variable # KDCPROXY_CONFIG to $KDCPROXY_CONFIG. # # Disable KDC Proxy on the current host: -# # ipa-ldap-updater /usr/share/ipa/kdcproxy-disable.uldif -# # systemctl restart httpd.service +# # ipa-ldap-updater $USR_SHARE_IPA_DIR/kdcproxy-disable.uldif +# # service apache24 restart # # Enable KDC Proxy on the current host: -# # ipa-ldap-updater /usr/share/ipa/kdcproxy-enable.uldif -# # systemctl restart httpd.service +# # ipa-ldap-updater $USR_SHARE_IPA_DIR/kdcproxy-enable.uldif +# # service apache24 restart # WSGIDaemonProcess kdcproxy processes=2 threads=15 maximum-requests=5000 \ - user=kdcproxy group=kdcproxy display-name=%{GROUP} -WSGIScriptAlias /KdcProxy /usr/share/ipa/kdcproxy.wsgi \ + user=kdcproxy group=kdcproxy display-name=%{GROUP} home=/var/empty +WSGIScriptAlias /KdcProxy $USR_SHARE_IPA_DIR/kdcproxy.wsgi \ process-group=kdcproxy application-group=%{GLOBAL} WSGIScriptReloading Off - Satisfy Any Require all granted diff --git a/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in b/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in index 1c4cd439da11..befc5c49cb03 100644 --- a/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in +++ b/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in @@ -1,18 +1,18 @@ --- install/tools/ipa-httpd-kdcproxy.in.orig 2025-01-15 09:52:51 UTC +++ install/tools/ipa-httpd-kdcproxy.in @@ -18,10 +18,12 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . # -"""ipa-httpd-kdproxy +"""ipa-httpd-kdcproxy -This script creates or removes the symlink from /etc/ipa/ipa-kdc-proxy.conf -to /etc/httpd/conf.d/. It's called from ExecStartPre hook in httpd.service. +This script creates or removes the symlink from -+/usr/local/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to -+/usr/local/etc/apache24/Includes/ipa-kdc-proxy.conf. It is called from the ++%%LOCALBASE%%/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to ++%%LOCALBASE%%/etc/apache24/Includes/ipa-kdc-proxy.conf. It is called from the +apache24 RC start and restart hooks. """ import logging import os diff --git a/net/freeipa-server/files/patch-install_updates_80-schema__compat.update b/net/freeipa-server/files/patch-install_updates_80-schema__compat.update index 604c26068239..52dba24e37a0 100644 --- a/net/freeipa-server/files/patch-install_updates_80-schema__compat.update +++ b/net/freeipa-server/files/patch-install_updates_80-schema__compat.update @@ -1,11 +1,11 @@ --- install/updates/80-schema_compat.update.orig 2026-08-10 18:01:22 UTC +++ install/updates/80-schema_compat.update @@ -9,7 +9,7 @@ default:cn: Schema Compatibility default:objectclass: nsSlapdPlugin default:objectclass: extensibleObject default:cn: Schema Compatibility -default:nsslapd-pluginpath: /usr/lib$LIBARCH/dirsrv/plugins/schemacompat-plugin.so -+default:nsslapd-pluginpath: /usr/local/lib/dirsrv/plugins/schemacompat-plugin.so ++default:nsslapd-pluginpath: %%LOCALBASE%%/lib/dirsrv/plugins/schemacompat-plugin.so default:nsslapd-plugininitfunc: schema_compat_plugin_init default:nsslapd-plugintype: object default:nsslapd-pluginenabled: on diff --git a/net/freeipa-server/files/patch-ipaplatform_base_paths.py b/net/freeipa-server/files/patch-ipaplatform_base_paths.py index 1159b57f7cb7..d25860254221 100644 --- a/net/freeipa-server/files/patch-ipaplatform_base_paths.py +++ b/net/freeipa-server/files/patch-ipaplatform_base_paths.py @@ -1,129 +1,129 @@ --- ipaplatform/base/paths.py.orig 2026-01-16 09:23:31 UTC +++ ipaplatform/base/paths.py @@ -88,13 +88,13 @@ class BasePathNamespace: NAMED_CUSTOM_CONF = "/etc/named/ipa-ext.conf" NAMED_LOGGING_OPTIONS_CONF = "/etc/named/ipa-logging-ext.conf" NAMED_CUSTOM_OPTIONS_CONF = "/etc/named/ipa-options-ext.conf" - NAMED_CONF_SRC = '/usr/share/ipa/bind.named.conf.template' - NAMED_CUSTOM_CONF_SRC = '/usr/share/ipa/bind.ipa-ext.conf.template' -+ NAMED_CONF_SRC = '/usr/local/share/ipa/bind.named.conf.template' -+ NAMED_CUSTOM_CONF_SRC = '/usr/local/share/ipa/bind.ipa-ext.conf.template' ++ NAMED_CONF_SRC = '%%PREFIX%%/share/ipa/bind.named.conf.template' ++ NAMED_CUSTOM_CONF_SRC = '%%PREFIX%%/share/ipa/bind.ipa-ext.conf.template' NAMED_CUSTOM_OPTIONS_CONF_SRC = ( - '/usr/share/ipa/bind.ipa-options-ext.conf.template' -+ '/usr/local/share/ipa/bind.ipa-options-ext.conf.template' ++ '%%PREFIX%%/share/ipa/bind.ipa-options-ext.conf.template' ) NAMED_LOGGING_OPTIONS_CONF_SRC = ( - "/usr/share/ipa/bind.ipa-logging-ext.conf.template" -+ "/usr/local/share/ipa/bind.ipa-logging-ext.conf.template" ++ "%%PREFIX%%/share/ipa/bind.ipa-logging-ext.conf.template" ) NAMED_VAR_DIR = "/var/named" NAMED_KEYTAB = "/etc/named.keytab" @@ -102,7 +102,7 @@ class BasePathNamespace: NAMED_ROOT_KEY = "/etc/named.root.key" NAMED_MANAGED_KEYS_DIR = "/var/named/dynamic" NAMED_CRYPTO_POLICY_FILE = None - UNBOUND_CONF_SRC = '/usr/share/ipa/client/unbound.conf.template' -+ UNBOUND_CONF_SRC = '/usr/local/share/ipa/client/unbound.conf.template' ++ UNBOUND_CONF_SRC = '%%LOCALBASE%%/share/ipa/client/unbound.conf.template' UNBOUND_CONFIG_DIR = "/etc/unbound/conf.d/" UNBOUND_CONF = "/etc/unbound/conf.d/zzz-ipa.conf" NSLCD_CONF = "/etc/nslcd.conf" @@ -143,11 +143,11 @@ class BasePathNamespace: LIMITS_CONF = "/etc/security/limits.conf" SSH_CONFIG_DIR = "/etc/ssh" SSH_CONFIG = "/etc/ssh/ssh_config" - SSH_IPA_CONFIG_TEMPLATE = "/usr/share/ipa/client/ssh_ipa.conf.template" -+ SSH_IPA_CONFIG_TEMPLATE = "/usr/local/share/ipa/client/ssh_ipa.conf.template" ++ SSH_IPA_CONFIG_TEMPLATE = "%%LOCALBASE%%/share/ipa/client/ssh_ipa.conf.template" SSH_IPA_CONFIG = "/etc/ssh/ssh_config.d/04-ipa.conf" SSHD_CONFIG = "/etc/ssh/sshd_config" SSHD_IPA_CONFIG = "/etc/ssh/sshd_config.d/04-ipa.conf" - SSHD_IPA_CONFIG_TEMPLATE = "/usr/share/ipa/client/sshd_ipa.conf.template" -+ SSHD_IPA_CONFIG_TEMPLATE = "/usr/local/share/ipa/client/sshd_ipa.conf.template" ++ SSHD_IPA_CONFIG_TEMPLATE = "%%LOCALBASE%%/share/ipa/client/sshd_ipa.conf.template" SSSD_CONF = "/etc/sssd/sssd.conf" SSSD_CONF_BKP = "/etc/sssd/sssd.conf.bkp" SSSD_CONF_DELETED = "/etc/sssd/sssd.conf.deleted" @@ -214,8 +214,8 @@ class BasePathNamespace: KLIST = "/usr/bin/klist" KTUTIL = "/usr/bin/ktutil" BIN_KVNO = "/usr/bin/kvno" - LDAPMODIFY = "/usr/bin/ldapmodify" - LDAPPASSWD = "/usr/bin/ldappasswd" -+ LDAPMODIFY = "/usr/local/bin/ldapmodify" -+ LDAPPASSWD = "/usr/local/bin/ldappasswd" ++ LDAPMODIFY = "%%LOCALBASE%%/bin/ldapmodify" ++ LDAPPASSWD = "%%LOCALBASE%%/bin/ldappasswd" MODUTIL = "/usr/bin/modutil" NET = "/usr/bin/net" BIN_NISDOMAINNAME = "/usr/bin/nisdomainname" @@ -283,6 +283,7 @@ class BasePathNamespace: PKIDESTROY = "/usr/sbin/pkidestroy" PKISPAWN = "/usr/sbin/pkispawn" PKI = "/usr/bin/pki" + PKI_SERVER = "/usr/sbin/pki-server" RESTORECON = "/usr/sbin/restorecon" SELINUXENABLED = "/usr/sbin/selinuxenabled" SETSEBOOL = "/usr/sbin/setsebool" @@ -292,16 +293,16 @@ class BasePathNamespace: FONTS_DIR = "/usr/share/fonts" FONTS_OPENSANS_DIR = "/usr/share/fonts/open-sans" FONTS_FONTAWESOME_DIR = "/usr/share/fonts/fontawesome" - USR_SHARE_IPA_DIR = "/usr/share/ipa/" - USR_SHARE_IPA_CLIENT_DIR = "/usr/share/ipa/client" - CA_TOPOLOGY_ULDIF = "/usr/share/ipa/ca-topology.uldif" - IPA_HTML_DIR = "/usr/share/ipa/html" - CA_CRT = "/usr/share/ipa/html/ca.crt" - SCHEMA_COMPAT_ULDIF = "/usr/share/ipa/updates/91-schema_compat.update" - SCHEMA_COMPAT_POST_ULDIF = "/usr/share/ipa/schema_compat_post.uldif" - SUBID_GENERATORS_ULDIF = "/usr/share/ipa/subid-generators.uldif" - IPA_JS_PLUGINS_DIR = "/usr/share/ipa/ui/js/plugins" - UPDATES_DIR = "/usr/share/ipa/updates/" -+ USR_SHARE_IPA_DIR = "/usr/local/share/ipa/" -+ USR_SHARE_IPA_CLIENT_DIR = "/usr/local/share/ipa/client" -+ CA_TOPOLOGY_ULDIF = "/usr/local/share/ipa/ca-topology.uldif" -+ IPA_HTML_DIR = "/usr/local/share/ipa/html" -+ CA_CRT = "/usr/local/share/ipa/html/ca.crt" -+ SCHEMA_COMPAT_ULDIF = "/usr/local/share/ipa/updates/91-schema_compat.update" -+ SCHEMA_COMPAT_POST_ULDIF = "/usr/local/share/ipa/schema_compat_post.uldif" -+ SUBID_GENERATORS_ULDIF = "/usr/local/share/ipa/subid-generators.uldif" -+ IPA_JS_PLUGINS_DIR = "/usr/local/share/ipa/ui/js/plugins" -+ UPDATES_DIR = "/usr/local/share/ipa/updates/" ++ USR_SHARE_IPA_DIR = "%%LOCALBASE%%/share/ipa/" ++ USR_SHARE_IPA_CLIENT_DIR = "%%LOCALBASE%%/share/ipa/client" ++ CA_TOPOLOGY_ULDIF = "%%PREFIX%%/share/ipa/ca-topology.uldif" ++ IPA_HTML_DIR = "%%LOCALBASE%%/share/ipa/html" ++ CA_CRT = "%%LOCALBASE%%/share/ipa/html/ca.crt" ++ SCHEMA_COMPAT_ULDIF = "%%LOCALBASE%%/share/ipa/updates/91-schema_compat.update" ++ SCHEMA_COMPAT_POST_ULDIF = "%%LOCALBASE%%/share/ipa/schema_compat_post.uldif" ++ SUBID_GENERATORS_ULDIF = "%%PREFIX%%/share/ipa/subid-generators.uldif" ++ IPA_JS_PLUGINS_DIR = "%%LOCALBASE%%/share/ipa/ui/js/plugins" ++ UPDATES_DIR = "%%LOCALBASE%%/share/ipa/updates/" DICT_WORDS = "/usr/share/dict/words" VAR_KERBEROS_KRB5KDC_DIR = "/var/kerberos/krb5kdc/" VAR_KRB5KDC_K5_REALM = "/var/kerberos/krb5kdc/.k5." @@ -408,7 +409,7 @@ class BasePathNamespace: IPA_RENEWAL_LOCK = "/run/ipa/renewal.lock" SVC_LIST_FILE = "/run/ipa/services.list" KRB5CC_SAMBA = "/run/samba/krb5cc_samba" - SLAPD_INSTANCE_SOCKET_TEMPLATE = "/run/slapd-%s.socket" + SLAPD_INSTANCE_SOCKET_TEMPLATE = "/var/run/slapd-%s.socket" ADMIN_CERT_PATH = '/root/.dogtag/pki-tomcat/ca_admin.cert' ENTROPY_AVAIL = '/proc/sys/kernel/random/entropy_avail' KDCPROXY_CONFIG = '/etc/ipa/kdcproxy/kdcproxy.conf' @@ -428,7 +429,7 @@ class BasePathNamespace: IPA_CUSTODIA_CHECK = "/usr/libexec/ipa/ipa-custodia-check" IPA_GETKEYTAB = '/usr/sbin/ipa-getkeytab' IPA_MIGRATE_LOG = '/var/log/ipa-migrate.log' - EXTERNAL_SCHEMA_DIR = '/usr/share/ipa/schema.d' -+ EXTERNAL_SCHEMA_DIR = '/usr/local/share/ipa/schema.d' ++ EXTERNAL_SCHEMA_DIR = '%%LOCALBASE%%/share/ipa/schema.d' GSSPROXY_CONF = '/etc/gssproxy/10-ipa.conf' KRB5CC_HTTPD = '/tmp/krb5cc-httpd' IF_INET6 = '/proc/net/if_inet6' @@ -442,9 +443,9 @@ class BasePathNamespace: DSCTL = '/usr/sbin/dsctl' DSCONF = '/usr/sbin/dsconf' # DS related constants - ETC_DIRSRV = "/etc/dirsrv" - DS_KEYTAB = "/etc/dirsrv/ds.keytab" - ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE = "/etc/dirsrv/slapd-%s" -+ ETC_DIRSRV = "/usr/local/etc/dirsrv" -+ DS_KEYTAB = "/usr/local/etc/dirsrv/ds.keytab" -+ ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE = "/usr/local/etc/dirsrv/slapd-%s" ++ ETC_DIRSRV = "%%LOCALBASE%%/etc/dirsrv" ++ DS_KEYTAB = "%%LOCALBASE%%/etc/dirsrv/ds.keytab" ++ ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE = "%%LOCALBASE%%/etc/dirsrv/slapd-%s" USR_LIB_DIRSRV = "/usr/lib/dirsrv" USR_LIB_DIRSRV_64 = "/usr/lib64/dirsrv" VAR_LIB_DIRSRV_INSTANCE_SCRIPTS_TEMPLATE = "/var/lib/dirsrv/scripts-%s" @@ -453,7 +454,7 @@ class BasePathNamespace: SLAPD_INSTANCE_DB_DIR_TEMPLATE = "/var/lib/dirsrv/slapd-%s/db/%s" SLAPD_INSTANCE_LDIF_DIR_TEMPLATE = "/var/lib/dirsrv/slapd-%s/ldif" DIRSRV_LOCK_DIR = "/run/lock/dirsrv" - ALL_SLAPD_INSTANCE_SOCKETS = "/run/slapd-*.socket" + ALL_SLAPD_INSTANCE_SOCKETS = "/var/run/slapd-*.socket" VAR_LOG_DIRSRV_INSTANCE_TEMPLATE = "/var/log/dirsrv/slapd-%s" VAR_LOG_DIRSRV = "/var/log/dirsrv/" SLAPD_INSTANCE_ACCESS_LOG_TEMPLATE = "/var/log/dirsrv/slapd-%s/access" diff --git a/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py b/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py index 8ffb4cf36f56..3db105deb092 100644 --- a/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py +++ b/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py @@ -1,231 +1,231 @@ --- ipaplatform/freebsd/paths.py.orig 2026-08-25 07:58:40 UTC +++ ipaplatform/freebsd/paths.py @@ -0,0 +1,228 @@ +# +# Copyright (C) 2026 FreeIPA Contributors see COPYING for license +# + +from ipaplatform.base.paths import BasePathNamespace + + +class FreeBSDPathNamespace(BasePathNamespace): -+ PKIDESTROY = "/usr/local/sbin/pkidestroy" -+ PKISPAWN = "/usr/local/sbin/pkispawn" -+ PKI = "/usr/local/bin/pki" -+ PKI_SERVER = "/usr/local/sbin/pki-server" -+ BIN_TOMCAT = "/usr/local/apache-tomcat-9.0/bin/catalina.sh" ++ PKIDESTROY = "%%LOCALBASE%%/sbin/pkidestroy" ++ PKISPAWN = "%%LOCALBASE%%/sbin/pkispawn" ++ PKI = "%%LOCALBASE%%/bin/pki" ++ PKI_SERVER = "%%LOCALBASE%%/sbin/pki-server" ++ BIN_TOMCAT = "%%LOCALBASE%%/apache-tomcat-9.0/bin/catalina.sh" + BIN_PS = "/bin/ps" + -+ PKI_CONFIGURATION = "/usr/local/etc/pki" ++ PKI_CONFIGURATION = "%%LOCALBASE%%/etc/pki" + PKI_TOMCAT = "/var/db/pki/pki-tomcat/conf" + PKI_TOMCAT_ALIAS_DIR = "/var/db/pki/pki-tomcat/alias" + PKI_TOMCAT_ALIAS_PWDFILE_TXT = "/var/db/pki/pki-tomcat/alias/pwdfile.txt" + PKI_TOMCAT_PASSWORD_CONF = "/var/db/pki/pki-tomcat/conf/password.conf" + PKI_TOMCAT_SERVER_XML = "/var/db/pki/pki-tomcat/conf/server.xml" + PKI_ACME_CONFIGSOURCES_CONF = "/var/db/pki/pki-tomcat/conf/acme/configsources.conf" + PKI_ACME_DATABASE_CONF = "/var/db/pki/pki-tomcat/conf/acme/database.conf" + PKI_ACME_ENGINE_CONF = "/var/db/pki/pki-tomcat/conf/acme/engine.conf" + PKI_ACME_ISSUER_CONF = "/var/db/pki/pki-tomcat/conf/acme/issuer.conf" + PKI_ACME_REALM_CONF = "/var/db/pki/pki-tomcat/conf/acme/realm.conf" + + VAR_LIB_PKI_DIR = "/var/db/pki" + VAR_LIB_PKI_CA_ALIAS_DIR = "/var/db/pki-ca/alias" + VAR_LIB_PKI_TOMCAT_DIR = "/var/db/pki/pki-tomcat" + CA_BACKUP_KEYS_P12 = "/var/db/pki/pki-tomcat/alias/ca_backup_keys.p12" + KRA_BACKUP_KEYS_P12 = "/var/db/pki/pki-tomcat/alias/kra_backup_keys.p12" + CA_CS_CFG_PATH = "/var/db/pki/pki-tomcat/conf/ca/CS.cfg" + CASIGNEDLOGCERT_CFG = "/var/db/pki/pki-tomcat/ca/profiles/ca/caSignedLogCert.cfg" + KRA_CS_CFG_PATH = "/var/db/pki/pki-tomcat/conf/kra/CS.cfg" + SVC_LIST_FILE = "/var/run/ipa/services.list" + IPA_OTPD_INETD_CONF = "/var/run/ipa/ipa-otpd.inetd.conf" + IPA_OTPD_INETD_PID = "/var/run/ipa/ipa-otpd-inetd.pid" + IPA_OTPD_SOCKET_DIR = "/var/run/krb5kdc" + IPA_OTPD_SOCKET = "/var/run/krb5kdc/DEFAULT.socket" + IPA_CCACHES = "/var/run/ipa/ccaches" + IPA_RENEWAL_LOCK = "/var/run/ipa/renewal.lock" -+ KLIST = "/usr/local/bin/klist" -+ KADMIN_LOCAL = "/usr/local/sbin/kadmin.local" -+ KDB5_UTIL = "/usr/local/sbin/kdb5_util" ++ KLIST = "%%LOCALBASE%%/bin/klist" ++ KADMIN_LOCAL = "%%LOCALBASE%%/sbin/kadmin.local" ++ KDB5_UTIL = "%%LOCALBASE%%/sbin/kdb5_util" + -+ ETC_IPA = "/usr/local/etc/ipa" -+ IPA_DEFAULT_CONF = "/usr/local/etc/ipa/default.conf" ++ ETC_IPA = "%%LOCALBASE%%/etc/ipa" ++ IPA_DEFAULT_CONF = "%%LOCALBASE%%/etc/ipa/default.conf" + -+ IPA_CUSTODIA_CONF_DIR = "/usr/local/etc/ipa/custodia" -+ IPA_CUSTODIA_CONF = "/usr/local/etc/ipa/custodia/custodia.conf" -+ IPA_CUSTODIA_KEYS = "/usr/local/etc/ipa/custodia/server.keys" ++ IPA_CUSTODIA_CONF_DIR = "%%LOCALBASE%%/etc/ipa/custodia" ++ IPA_CUSTODIA_CONF = "%%LOCALBASE%%/etc/ipa/custodia/custodia.conf" ++ IPA_CUSTODIA_KEYS = "%%LOCALBASE%%/etc/ipa/custodia/server.keys" + IPA_CUSTODIA_SOCKET = "/var/run/httpd/ipa-custodia.sock" + -+ KDCPROXY_CONFIG = "/usr/local/etc/ipa/kdcproxy/kdcproxy.conf" ++ KDCPROXY_CONFIG = "%%PREFIX%%/etc/ipa/kdcproxy/kdcproxy.conf" + + VAR_LIB_IPA = "/var/db/ipa" + CA_BUNDLE_PEM = "/var/db/ipa-client/pki/ca-bundle.pem" + KDC_CA_BUNDLE_PEM = "/var/db/ipa-client/pki/kdc-ca-bundle.pem" + HTTPD_CERT_FILE = "/var/db/ipa/certs/httpd.crt" + HTTPD_KEY_FILE = "/var/db/ipa/private/httpd.key" + HTTPD_PASSWD_FILE_FMT = "/var/db/ipa/passwds/{host}-443-RSA" + HTTP_KEYTAB = "/var/db/ipa/gssproxy/http.keytab" -+ GSSPROXY_CONF = "/usr/local/etc/gssproxy/10-ipa.conf" ++ GSSPROXY_CONF = "%%LOCALBASE%%/etc/gssproxy/10-ipa.conf" + IPA_CCACHE_SWEEPER_GSSPROXY_SOCK = ( + "/var/db/gssproxy/ipa_ccache_sweeper.sock" + ) + RA_AGENT_PEM = "/var/db/ipa/ra-agent.pem" + RA_AGENT_KEY = "/var/db/ipa/ra-agent.key" + IPA_BACKUP_DIR = "/var/db/ipa/backup" + IPA_DNSSEC_DIR = "/var/db/ipa/dnssec" + IPA_KASP_DB_BACKUP = "/var/db/ipa/ipa-kasp.db.backup" + DNSSEC_TOKENS_DIR = "/var/db/ipa/dnssec/tokens" + DNSSEC_SOFTHSM_PIN = "/var/db/ipa/dnssec/softhsm_pin" + IPA_CA_CSR = "/var/db/ipa/ca.csr" + REPLICA_INFO_TEMPLATE = "/var/db/ipa/replica-info-%s" + REPLICA_INFO_GPG_TEMPLATE = "/var/db/ipa/replica-info-%s.gpg" + PKI_CA_PUBLISH_DIR = "/var/db/ipa/pki-ca/publish" -+ CERTUTIL = "/usr/local/bin/certutil" -+ PK12UTIL = "/usr/local/bin/pk12util" -+ MODUTIL = "/usr/local/bin/modutil" ++ CERTUTIL = "%%LOCALBASE%%/bin/certutil" ++ PK12UTIL = "%%LOCALBASE%%/bin/pk12util" ++ MODUTIL = "%%LOCALBASE%%/bin/modutil" + SYSCONFIG_PKI_TOMCAT = "/var/db/pki/pki-tomcat/conf/tomcat.conf" -+ SYSCONFIG_PKI_TOMCAT_PKI_TOMCAT_DIR = "/usr/local/etc/pki/tomcat/pki-tomcat" ++ SYSCONFIG_PKI_TOMCAT_PKI_TOMCAT_DIR = "%%LOCALBASE%%/etc/pki/tomcat/pki-tomcat" + IPA_CLIENT_SYSRESTORE = "/var/db/ipa-client/sysrestore" + SYSRESTORE_INDEX = "/var/db/ipa-client/sysrestore/sysrestore.index" + SYSRESTORE = "/var/db/ipa/sysrestore" + STATEFILE_DIR = "/var/db/ipa/sysupgrade" + -+ VAR_KERBEROS_KRB5KDC_DIR = "/usr/local/var/krb5kdc/" -+ KRB5_CONF = "/usr/local/etc/krb5.conf" -+ COMMON_KRB5_CONF_DIR = "/usr/local/etc/krb5.conf.d/" -+ KRB5_FREEIPA_DEFAULTS = "/usr/local/etc/krb5.conf.d/freeipa" -+ KRB5_FREEIPA = "/usr/local/etc/krb5.conf.d/freeipa-realm" -+ KRB5_FREEIPA_SERVER = "/usr/local/etc/krb5.conf.d/freeipa-server" -+ VAR_KRB5KDC_K5_REALM = "/usr/local/var/krb5kdc/.k5." -+ CACERT_PEM = "/usr/local/var/krb5kdc/cacert.pem" -+ KRB5KDC_KADM5_ACL = "/usr/local/var/krb5kdc/kadm5.acl" -+ KRB5KDC_KADM5_KEYTAB = "/usr/local/var/krb5kdc/kadm5.keytab" -+ KRB5KDC_KDC_CONF = "/usr/local/var/krb5kdc/kdc.conf" -+ KDC_CERT = "/usr/local/var/krb5kdc/kdc.crt" -+ KDC_KEY = "/usr/local/var/krb5kdc/kdc.key" -+ -+ IPACTL = "/usr/local/sbin/ipactl" -+ IPA_CLIENT_AUTOMOUNT = "/usr/local/sbin/ipa-client-automount" -+ IPA_CLIENT_INSTALL = "/usr/local/sbin/ipa-client-install" -+ IPA_GETKEYTAB = "/usr/local/sbin/ipa-getkeytab" -+ IPA_RMKEYTAB = "/usr/local/sbin/ipa-rmkeytab" -+ SBIN_IPA_JOIN = "/usr/local/sbin/ipa-join" -+ CONNCHECK_CCACHE = "/usr/local/etc/ipa/.conncheck_ccache" -+ IPA_DNS_CCACHE = "/usr/local/etc/ipa/.dns_ccache" -+ OPENLDAP_LDAP_CONF = "/usr/local/etc/openldap/ldap.conf" -+ IPA_DNS_UPDATE_TXT = "/usr/local/etc/ipa/.dns_update.txt" -+ IPA_CA_CRT = "/usr/local/etc/ipa/ca.crt" -+ IPA_DNSKEYSYNCD_KEYTAB = "/usr/local/etc/ipa/dnssec/ipa-dnskeysyncd.keytab" -+ IPA_ODS_EXPORTER_KEYTAB = "/usr/local/etc/ipa/dnssec/ipa-ods-exporter.keytab" -+ IPA_SERVER_CONF = "/usr/local/etc/ipa/server.conf" -+ DNSSEC_OPENSSL_CONF = "/usr/local/etc/ipa/dnssec/openssl.cnf" -+ DNSSEC_SOFTHSM2_CONF = "/usr/local/etc/ipa/dnssec/softhsm2.conf" -+ DNSSEC_SOFTHSM_PIN_SO = "/usr/local/etc/ipa/dnssec/softhsm_pin_so" -+ IPA_NSSDB_DIR = "/usr/local/etc/ipa/nssdb" -+ IPA_NSSDB_PWDFILE_TXT = "/usr/local/etc/ipa/nssdb/pwdfile.txt" -+ NSS_DB_DIR = "/usr/local/etc/pki/nssdb" -+ -+ LIBEXEC_IPA_DIR = "/usr/local/libexec/ipa" -+ IPA_OTPD = "/usr/local/libexec/ipa/ipa-otpd" -+ IPA_OTPD_WRAPPER = "/usr/local/libexec/ipa/ipa-otpd-wrapper" ++ VAR_KERBEROS_KRB5KDC_DIR = "%%LOCALBASE%%/var/krb5kdc/" ++ KRB5_CONF = "%%LOCALBASE%%/etc/krb5.conf" ++ COMMON_KRB5_CONF_DIR = "%%LOCALBASE%%/etc/krb5.conf.d/" ++ KRB5_FREEIPA_DEFAULTS = "%%LOCALBASE%%/etc/krb5.conf.d/freeipa" ++ KRB5_FREEIPA = "%%LOCALBASE%%/etc/krb5.conf.d/freeipa-realm" ++ KRB5_FREEIPA_SERVER = "%%LOCALBASE%%/etc/krb5.conf.d/freeipa-server" ++ VAR_KRB5KDC_K5_REALM = "%%LOCALBASE%%/var/krb5kdc/.k5." ++ CACERT_PEM = "%%LOCALBASE%%/var/krb5kdc/cacert.pem" ++ KRB5KDC_KADM5_ACL = "%%LOCALBASE%%/var/krb5kdc/kadm5.acl" ++ KRB5KDC_KADM5_KEYTAB = "%%LOCALBASE%%/var/krb5kdc/kadm5.keytab" ++ KRB5KDC_KDC_CONF = "%%LOCALBASE%%/var/krb5kdc/kdc.conf" ++ KDC_CERT = "%%LOCALBASE%%/var/krb5kdc/kdc.crt" ++ KDC_KEY = "%%LOCALBASE%%/var/krb5kdc/kdc.key" ++ ++ IPACTL = "%%PREFIX%%/sbin/ipactl" ++ IPA_CLIENT_AUTOMOUNT = "%%PREFIX%%/sbin/ipa-client-automount" ++ IPA_CLIENT_INSTALL = "%%PREFIX%%/sbin/ipa-client-install" ++ IPA_GETKEYTAB = "%%PREFIX%%/sbin/ipa-getkeytab" ++ IPA_RMKEYTAB = "%%PREFIX%%/sbin/ipa-rmkeytab" ++ SBIN_IPA_JOIN = "%%PREFIX%%/sbin/ipa-join" ++ CONNCHECK_CCACHE = "%%LOCALBASE%%/etc/ipa/.conncheck_ccache" ++ IPA_DNS_CCACHE = "%%LOCALBASE%%/etc/ipa/.dns_ccache" ++ OPENLDAP_LDAP_CONF = "%%LOCALBASE%%/etc/openldap/ldap.conf" ++ IPA_DNS_UPDATE_TXT = "%%LOCALBASE%%/etc/ipa/.dns_update.txt" ++ IPA_CA_CRT = "%%LOCALBASE%%/etc/ipa/ca.crt" ++ IPA_DNSKEYSYNCD_KEYTAB = "%%LOCALBASE%%/etc/ipa/dnssec/ipa-dnskeysyncd.keytab" ++ IPA_ODS_EXPORTER_KEYTAB = "%%LOCALBASE%%/etc/ipa/dnssec/ipa-ods-exporter.keytab" ++ IPA_SERVER_CONF = "%%LOCALBASE%%/etc/ipa/server.conf" ++ DNSSEC_OPENSSL_CONF = "%%LOCALBASE%%/etc/ipa/dnssec/openssl.cnf" ++ DNSSEC_SOFTHSM2_CONF = "%%LOCALBASE%%/etc/ipa/dnssec/softhsm2.conf" ++ DNSSEC_SOFTHSM_PIN_SO = "%%LOCALBASE%%/etc/ipa/dnssec/softhsm_pin_so" ++ IPA_NSSDB_DIR = "%%LOCALBASE%%/etc/ipa/nssdb" ++ IPA_NSSDB_PWDFILE_TXT = "%%LOCALBASE%%/etc/ipa/nssdb/pwdfile.txt" ++ NSS_DB_DIR = "%%LOCALBASE%%/etc/pki/nssdb" ++ ++ LIBEXEC_IPA_DIR = "%%LOCALBASE%%/libexec/ipa" ++ IPA_OTPD = "%%PREFIX%%/libexec/ipa/ipa-otpd" ++ IPA_OTPD_WRAPPER = "%%PREFIX%%/libexec/ipa/ipa-otpd-wrapper" + IPA_OTPD_LOG = "/var/log/ipa-otpd.log" -+ LIBEXEC_CERTMONGER_DIR = "/usr/local/libexec/certmonger" -+ CERTMONGER_COMMAND_TEMPLATE = "/usr/local/libexec/ipa/certmonger/%s" -+ CERTMONGER_DOGTAG_SUBMIT = "/usr/local/libexec/certmonger/dogtag-submit" -+ DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "/usr/local/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit" -+ DOGTAG_IPA_RENEW_AGENT_SUBMIT = "/usr/local/libexec/certmonger/dogtag-ipa-renew-agent-submit" -+ IPA_SERVER_GUARD = "/usr/local/libexec/certmonger/ipa-server-guard" -+ IPA_DNSKEYSYNCD_REPLICA = "/usr/local/libexec/ipa/ipa-dnskeysync-replica" -+ IPA_DNSKEYSYNCD = "/usr/local/libexec/ipa/ipa-dnskeysyncd" -+ IPA_ODS_EXPORTER = "/usr/local/libexec/ipa/ipa-ods-exporter" -+ IPA_PKI_RETRIEVE_KEY = "/usr/local/libexec/ipa/ipa-pki-retrieve-key" -+ IPA_PKI_WAIT_RUNNING = "/usr/local/libexec/ipa/ipa-pki-wait-running" -+ IPA_CUSTODIA_HANDLER = "/usr/local/libexec/ipa/custodia" -+ IPA_CUSTODIA_CHECK = "/usr/local/libexec/ipa/ipa-custodia-check" -+ -+ SSSD_CONF = "/usr/local/etc/sssd/sssd.conf" -+ SSSD_CONF_BKP = "/usr/local/etc/sssd/sssd.conf.bkp" -+ SSSD_CONF_DELETED = "/usr/local/etc/sssd/sssd.conf.deleted" ++ LIBEXEC_CERTMONGER_DIR = "%%LOCALBASE%%/libexec/certmonger" ++ CERTMONGER_COMMAND_TEMPLATE = "%%LOCALBASE%%/libexec/ipa/certmonger/%s" ++ CERTMONGER_DOGTAG_SUBMIT = "%%LOCALBASE%%/libexec/certmonger/dogtag-submit" ++ DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "%%PREFIX%%/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit" ++ DOGTAG_IPA_RENEW_AGENT_SUBMIT = "%%LOCALBASE%%/libexec/certmonger/dogtag-ipa-renew-agent-submit" ++ IPA_SERVER_GUARD = "%%PREFIX%%/libexec/certmonger/ipa-server-guard" ++ IPA_DNSKEYSYNCD_REPLICA = "%%PREFIX%%/libexec/ipa/ipa-dnskeysync-replica" ++ IPA_DNSKEYSYNCD = "%%PREFIX%%/libexec/ipa/ipa-dnskeysyncd" ++ IPA_ODS_EXPORTER = "%%PREFIX%%/libexec/ipa/ipa-ods-exporter" ++ IPA_PKI_RETRIEVE_KEY = "%%PREFIX%%/libexec/ipa/ipa-pki-retrieve-key" ++ IPA_PKI_WAIT_RUNNING = "%%PREFIX%%/libexec/ipa/ipa-pki-wait-running" ++ IPA_CUSTODIA_HANDLER = "%%LOCALBASE%%/libexec/ipa/custodia" ++ IPA_CUSTODIA_CHECK = "%%PREFIX%%/libexec/ipa/ipa-custodia-check" ++ ++ SSSD_CONF = "%%LOCALBASE%%/etc/sssd/sssd.conf" ++ SSSD_CONF_BKP = "%%LOCALBASE%%/etc/sssd/sssd.conf.bkp" ++ SSSD_CONF_DELETED = "%%LOCALBASE%%/etc/sssd/sssd.conf.deleted" + SSSD_DB = "/var/db/sss/db" + SSSD_LDB = "/var/db/sss/db/sssd.ldb" + SSSD_CONFIG_LDB = "/var/db/sss/db/config.ldb" + SSSD_MC_GROUP = "/var/db/sss/mc/group" + SSSD_MC_PASSWD = "/var/db/sss/mc/passwd" + SSSD_MC_INITGROUPS = "/var/db/sss/mc/initgroups" + SSSD_MC_SID = "/var/db/sss/mc/sid" + SSSD_PIPES = "/var/db/sss/pipes" + SSSD_PUBCONF_DIR = "/var/db/sss/pubconf" + SSSD_PUBCONF_KNOWN_HOSTS = "/var/db/sss/pubconf/known_hosts" + SSSD_PUBCONF_KRB5_INCLUDE_D_DIR = "/var/db/sss/pubconf/krb5.include.d/" + SSSD_KEYTABS_DIR = "/var/db/sss/keytabs" + SSSD_SECRETS = "/var/db/sss/secrets/secrets.ldb" + -+ DSCTL = "/usr/local/bin/dsctl" ++ DSCTL = "%%LOCALBASE%%/bin/dsctl" + + VAR_LIB_DIRSRV = "/var/db/dirsrv" + VAR_LIB_DIRSRV_INSTANCE_SCRIPTS_TEMPLATE = "/var/db/dirsrv/scripts-%s" + VAR_LIB_SLAPD_INSTANCE_DIR_TEMPLATE = "/var/db/dirsrv/slapd-%s" + SLAPD_INSTANCE_BACKUP_DIR_TEMPLATE = "/var/db/dirsrv/slapd-%s/bak/%s" + SLAPD_INSTANCE_DB_DIR_TEMPLATE = "/var/db/dirsrv/slapd-%s/db/%s" + SLAPD_INSTANCE_LDIF_DIR_TEMPLATE = "/var/db/dirsrv/slapd-%s/ldif" + VAR_RUN_DIRSRV_DIR = "/var/run/dirsrv" + DIRSRV_LOCK_DIR = "/var/run/dirsrv" + -+ HTTPD = "/usr/local/sbin/httpd" -+ ETC_HTTPD_DIR = "/usr/local/etc/apache24" -+ HTTPD_ALIAS_DIR = "/usr/local/etc/apache24/alias" -+ GSSAPI_SESSION_KEY = "/usr/local/etc/apache24/alias/ipasession.key" -+ HTTPD_CONF_D_DIR = "/usr/local/etc/apache24/Includes/" -+ HTTPD_IPA_WSGI_MODULES_CONF = "/usr/local/etc/apache24/modules.d/290_freeipa.conf" -+ HTTPD_IPA_ENVVARS_CONF = "/usr/local/etc/apache24/envvars.d/ipa.env" -+ HTTPD_IPA_RC_CONF = "/usr/local/etc/rc.conf.d/apache24/ipa" -+ HTTPD_IPA_CONF = "/usr/local/etc/apache24/Includes/ipa.conf" -+ HTTPD_IPA_KDCPROXY_CONF = "/usr/local/etc/ipa/kdcproxy/ipa-kdc-proxy.conf" -+ HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/usr/local/etc/apache24/Includes/ipa-kdc-proxy.conf" -+ HTTPD_IPA_PKI_PROXY_CONF = "/usr/local/etc/apache24/Includes/ipa-pki-proxy.conf" -+ HTTPD_IPA_REWRITE_CONF = "/usr/local/etc/apache24/Includes/ipa-rewrite.conf" -+ HTTPD_NSS_CONF = "/usr/local/etc/apache24/Includes/nss.conf" -+ HTTPD_PASSWORD_CONF = "/usr/local/etc/apache24/password.conf" -+ HTTPD_SSL_CONF = "/usr/local/etc/apache24/extra/httpd-ssl.conf" -+ HTTPD_SSL_SITE_CONF = "/usr/local/etc/apache24/extra/httpd-ssl.conf" -+ HTTPD_IPA_SSL_CONF_SYMLINK = "/usr/local/etc/apache24/Includes/ipa-ssl.conf" -+ OLD_IPA_KEYTAB = "/usr/local/etc/apache24/ipa.keytab" -+ OLD_KRA_AGENT_PEM = "/usr/local/etc/apache24/alias/kra-agent.pem" ++ HTTPD = "%%LOCALBASE%%/sbin/httpd" ++ ETC_HTTPD_DIR = "%%LOCALBASE%%/etc/apache24" ++ HTTPD_ALIAS_DIR = "%%LOCALBASE%%/etc/apache24/alias" ++ GSSAPI_SESSION_KEY = "%%LOCALBASE%%/etc/apache24/alias/ipasession.key" ++ HTTPD_CONF_D_DIR = "%%LOCALBASE%%/etc/apache24/Includes/" ++ HTTPD_IPA_WSGI_MODULES_CONF = "%%LOCALBASE%%/etc/apache24/modules.d/290_freeipa.conf" ++ HTTPD_IPA_ENVVARS_CONF = "%%LOCALBASE%%/etc/apache24/envvars.d/ipa.env" ++ HTTPD_IPA_RC_CONF = "%%LOCALBASE%%/etc/rc.conf.d/apache24/ipa" ++ HTTPD_IPA_CONF = "%%LOCALBASE%%/etc/apache24/Includes/ipa.conf" ++ HTTPD_IPA_KDCPROXY_CONF = "%%LOCALBASE%%/etc/ipa/kdcproxy/ipa-kdc-proxy.conf" ++ HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "%%LOCALBASE%%/etc/apache24/Includes/ipa-kdc-proxy.conf" ++ HTTPD_IPA_PKI_PROXY_CONF = "%%LOCALBASE%%/etc/apache24/Includes/ipa-pki-proxy.conf" ++ HTTPD_IPA_REWRITE_CONF = "%%LOCALBASE%%/etc/apache24/Includes/ipa-rewrite.conf" ++ HTTPD_NSS_CONF = "%%LOCALBASE%%/etc/apache24/Includes/nss.conf" ++ HTTPD_PASSWORD_CONF = "%%LOCALBASE%%/etc/apache24/password.conf" ++ HTTPD_SSL_CONF = "%%LOCALBASE%%/etc/apache24/extra/httpd-ssl.conf" ++ HTTPD_SSL_SITE_CONF = "%%LOCALBASE%%/etc/apache24/extra/httpd-ssl.conf" ++ HTTPD_IPA_SSL_CONF_SYMLINK = "%%LOCALBASE%%/etc/apache24/Includes/ipa-ssl.conf" ++ OLD_IPA_KEYTAB = "%%LOCALBASE%%/etc/apache24/ipa.keytab" ++ OLD_KRA_AGENT_PEM = "%%LOCALBASE%%/etc/apache24/alias/kra-agent.pem" + WSGI_PREFIX_DIR = "/var/run/httpd/wsgi" -+ IPA_HTTPD_KDCPROXY = "/usr/local/libexec/ipa/ipa-httpd-kdcproxy" -+ IPA_HTTPD_PASSWD_READER = "/usr/local/libexec/ipa/ipa-httpd-pwdreader" -+ -+ BIN_CURL = "/usr/local/bin/curl" -+ CERTMONGER = "/usr/local/sbin/certmonger" -+ GPG2 = "/usr/local/bin/gpg" -+ GPG_AGENT = "/usr/local/bin/gpg-agent" -+ IPA_DNS_INSTALL = "/usr/local/sbin/ipa-dns-install" -+ IPA_REPLICA_CONNCHECK = "/usr/local/sbin/ipa-replica-conncheck" -+ IPA_SERVER_UPGRADE = "/usr/local/sbin/ipa-server-upgrade" -+ KDESTROY = "/usr/local/bin/kdestroy" -+ KINIT = "/usr/local/bin/kinit" -+ KTUTIL = "/usr/local/bin/ktutil" -+ NET = "/usr/local/bin/net" -+ NSUPDATE = "/usr/local/bin/nsupdate" -+ SMBD = "/usr/local/sbin/smbd" -+ SSSCTL = "/usr/local/sbin/sssctl" -+ SSS_SSH_AUTHORIZEDKEYS = "/usr/local/bin/sss_ssh_authorizedkeys" -+ SSS_SSH_KNOWNHOSTS = "/usr/local/bin/sss_ssh_knownhosts" -+ SSS_SSH_KNOWNHOSTSPROXY = "/usr/local/bin/sss_ssh_knownhostsproxy" -+ TDBTOOL = "/usr/local/bin/tdbtool" -+ -+ IPA_CACERT_MANAGE = "/usr/local/sbin/ipa-cacert-manage" -+ IPA_GETCERT = "/usr/local/bin/ipa-getcert" -+ -+ CHRONYC = "/usr/local/bin/chronyc" -+ CHRONYD = "/usr/local/sbin/chronyd" -+ CHRONY_CONF = "/usr/local/etc/chrony.conf" ++ IPA_HTTPD_KDCPROXY = "%%PREFIX%%/libexec/ipa/ipa-httpd-kdcproxy" ++ IPA_HTTPD_PASSWD_READER = "%%PREFIX%%/libexec/ipa/ipa-httpd-pwdreader" ++ ++ BIN_CURL = "%%LOCALBASE%%/bin/curl" ++ CERTMONGER = "%%LOCALBASE%%/sbin/certmonger" ++ GPG2 = "%%LOCALBASE%%/bin/gpg" ++ GPG_AGENT = "%%LOCALBASE%%/bin/gpg-agent" ++ IPA_DNS_INSTALL = "%%PREFIX%%/sbin/ipa-dns-install" ++ IPA_REPLICA_CONNCHECK = "%%PREFIX%%/sbin/ipa-replica-conncheck" ++ IPA_SERVER_UPGRADE = "%%PREFIX%%/sbin/ipa-server-upgrade" ++ KDESTROY = "%%LOCALBASE%%/bin/kdestroy" ++ KINIT = "%%LOCALBASE%%/bin/kinit" ++ KTUTIL = "%%LOCALBASE%%/bin/ktutil" ++ NET = "%%LOCALBASE%%/bin/net" ++ NSUPDATE = "%%LOCALBASE%%/bin/nsupdate" ++ SMBD = "%%LOCALBASE%%/sbin/smbd" ++ SSSCTL = "%%LOCALBASE%%/sbin/sssctl" ++ SSS_SSH_AUTHORIZEDKEYS = "%%LOCALBASE%%/bin/sss_ssh_authorizedkeys" ++ SSS_SSH_KNOWNHOSTS = "%%LOCALBASE%%/bin/sss_ssh_knownhosts" ++ SSS_SSH_KNOWNHOSTSPROXY = "%%LOCALBASE%%/bin/sss_ssh_knownhostsproxy" ++ TDBTOOL = "%%LOCALBASE%%/bin/tdbtool" ++ ++ IPA_CACERT_MANAGE = "%%PREFIX%%/sbin/ipa-cacert-manage" ++ IPA_GETCERT = "%%LOCALBASE%%/bin/ipa-getcert" ++ ++ CHRONYC = "%%LOCALBASE%%/bin/chronyc" ++ CHRONYD = "%%LOCALBASE%%/sbin/chronyd" ++ CHRONY_CONF = "%%LOCALBASE%%/etc/chrony.conf" + + SYSTEMCTL = None + SYSTEMD_TMPFILES = None + SBIN_INETD = "/usr/sbin/inetd" + SBIN_DAEMON = "/usr/sbin/daemon" + SBIN_SERVICE = "/usr/sbin/service" + SBIN_SYSRC = "/usr/sbin/sysrc" + + +paths = FreeBSDPathNamespace() diff --git a/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py b/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py index a5df0aba1308..c21366ce1d7b 100644 --- a/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py +++ b/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py @@ -1,579 +1,587 @@ --- ipaplatform/freebsd/services.py.orig 2026-08-19 14:16:07 UTC +++ ipaplatform/freebsd/services.py -@@ -0,0 +1,576 @@ +@@ -0,0 +1,584 @@ +# +# Copyright (C) 2026 FreeIPA Contributors see COPYING for license +# + +import errno +import json +import logging +import os +import signal +import stat +import time +from configparser import RawConfigParser + +from ipaplatform.base import services as base_services +from ipaplatform.paths import paths +from ipapython import ipautil + +logger = logging.getLogger(__name__) + +freebsd_rc_services = dict((name, name) for name in base_services.wellknownservices) +freebsd_rc_services.update({ + "httpd": "apache24", + "kadmin": "kadmind", + "krb5kdc": "kdc", + "pki_tomcatd": "pki_tomcatd_pki_tomcat", + "pki-tomcatd": "pki_tomcatd_pki_tomcat", + "domainname": "nisdomain", +}) + +freebsd_rc_enable_names = { + "ipa-custodia": "ipa_custodia", +} + +# certmonger and oddjobd talk to the system message bus. On Linux dbus +# is socket-activated and therefore always available; on FreeBSD it is an +# ordinary rc service that is disabled by default. Without it certmonger +# refuses to start and oddjobd retries forever, which stalls the boot +# before sshd. Treat the bus as a hard prerequisite of both. +freebsd_dbus_consumers = ("certmonger", "oddjobd") + +freebsd_kerberos_rc_programs = { + "kdc": { -+ "kdc_program": "/usr/local/sbin/krb5kdc", ++ "kdc_program": "%%LOCALBASE%%/sbin/krb5kdc", + }, + "kadmind": { -+ "kdc_program": "/usr/local/sbin/krb5kdc", -+ "kadmind_program": "/usr/local/sbin/kadmind", ++ "kdc_program": "%%LOCALBASE%%/sbin/krb5kdc", ++ "kadmind_program": "%%LOCALBASE%%/sbin/kadmind", + }, +} + +freebsd_kerberos_rc_enables = { + "kdc": { + "kdc_enable": "YES", + }, + "kadmind": { + "kdc_enable": "YES", + "kadmind_enable": "YES", + }, +} + + +class FreeBSDService(base_services.PlatformService): + def __init__(self, service_name, api=None): + super(FreeBSDService, self).__init__(service_name, api=api) + self.rc_name = freebsd_rc_services.get(service_name, service_name) + self.rc_enable_name = freebsd_rc_enable_names.get( + self.rc_name, self.rc_name.replace("-", "_") + ) + + def _set_rcvars(self, rcvars): + for key, value in rcvars.items(): + try: + ipautil.run([paths.SBIN_SYSRC, "%s=%s" % (key, value)]) + except ipautil.CalledProcessError: + pass + + def _ensure_message_bus(self): + try: + ipautil.run([paths.SBIN_SYSRC, "dbus_enable=YES"]) + except ipautil.CalledProcessError: + pass + try: + ipautil.run([paths.SBIN_SERVICE, "dbus", "onestatus"], + capture_output=True) + except ipautil.CalledProcessError: + try: + ipautil.run([paths.SBIN_SERVICE, "dbus", "onestart"], + skip_output=True) + except ipautil.CalledProcessError: + logger.warning("Could not start the D-Bus system bus; " + "certmonger and oddjobd will not work") + + def _prepare_rc_service(self, action): + # The *_program variables tell rc(8) which binary belongs to a + # service. /etc/rc.d/kadmind defines no command of its own, so + # without kadmind_program even "onestatus" cannot see a running + # daemon. The paths are a static property of the MIT krb5 + # installation, hence assert them before every rc action rather + # than only before a start; the *_enable flags stay the business + # of enable() and disable(). + self._set_rcvars( + freebsd_kerberos_rc_programs.get(self.rc_name, {})) + if action not in ("onestart", "onerestart", "start", "restart"): + return + if self.rc_name in freebsd_dbus_consumers: + self._ensure_message_bus() + self._set_rcvars( + freebsd_kerberos_rc_enables.get(self.rc_name, {})) + + def _run_service(self, action, capture_output=True): + self._prepare_rc_service(action) + daemonizing = action in ("onestart", "onerestart", "start", "restart") + # rc.d daemons may inherit stdout and stderr. Redirect daemonizing + # actions to /dev/null to avoid waiting on inherited output pipes. + return ipautil.run( + [paths.SBIN_SERVICE, self.rc_name, action], + skip_output=daemonizing or not capture_output + ) + ++ def _run_service_tolerant(self, action, capture_output=True): ++ try: ++ self._run_service(action, capture_output=capture_output) ++ except ipautil.CalledProcessError: ++ if self.is_running(): ++ logger.warning( ++ "'%s %s' reported a failure but the service is running, " ++ "continuing", self.rc_name, action) ++ return ++ # FreeBSD base rc scripts for the Kerberos daemons (kdc, ++ # kadmind) can fail to (re)start while the environment is ++ # being torn down -- e.g. SimpleServiceInstance.uninstall() ++ # restores a previously-running kadmind after krb5kdc/DS ++ # were already unconfigured. Aborting the whole uninstall ++ # over a best-effort restore is worse than continuing; a ++ # genuine install-time failure still surfaces at the first ++ # real use of the service. ++ if self.rc_name not in ("kdc", "kadmind"): ++ raise ++ logger.warning( ++ "Ignoring failed '%s %s' (service could not be started; " ++ "likely mid-teardown restore)", self.rc_name, action) ++ + def start(self, instance_name="", capture_output=True, wait=True): + os.makedirs(os.path.dirname(paths.SVC_LIST_FILE), mode=0o711, exist_ok=True) + if not self.is_running(instance_name, wait=wait): -+ try: -+ self._run_service("onestart", capture_output=capture_output) -+ except ipautil.CalledProcessError: -+ # FreeBSD base rc scripts for the Kerberos daemons (kdc, -+ # kadmind) can fail to (re)start while the environment is -+ # being torn down -- e.g. SimpleServiceInstance.uninstall() -+ # restores a previously-running kadmind after krb5kdc/DS -+ # were already unconfigured. Aborting the whole uninstall -+ # over a best-effort restore is worse than continuing; a -+ # genuine install-time failure still surfaces at the first -+ # real use of the service. -+ if self.rc_name not in ("kdc", "kadmind"): -+ raise -+ logger.warning( -+ "Ignoring failed '%s onestart' (service could not be " -+ "started; likely mid-teardown restore)", self.rc_name) ++ self._run_service_tolerant("onestart", capture_output=capture_output) + super(FreeBSDService, self).start( + instance_name, capture_output=capture_output, wait=wait + ) + + def stop(self, instance_name="", capture_output=True): + if self.is_running(instance_name): + self._run_service("onestop", capture_output=capture_output) + super(FreeBSDService, self).stop( + instance_name, capture_output=capture_output + ) + + def restart(self, instance_name="", capture_output=True, wait=True): -+ self._run_service("onerestart", capture_output=capture_output) ++ self._run_service_tolerant("onerestart", capture_output=capture_output) + + def try_restart(self, instance_name="", capture_output=True, wait=True): + if self.is_running(instance_name, wait=wait): + self.restart(instance_name, capture_output=capture_output, wait=wait) + + def reload_or_restart(self, instance_name="", capture_output=True, wait=True): + self.restart(instance_name, capture_output=capture_output, wait=wait) + + def is_running(self, instance_name="", wait=True): + try: + self._run_service("onestatus", capture_output=True) + except ipautil.CalledProcessError: + return False + return True + + def is_installed(self): + return ( + os.path.exists("/etc/rc.d/%s" % self.rc_name) or -+ os.path.exists("/usr/local/etc/rc.d/%s" % self.rc_name) ++ os.path.exists("%%LOCALBASE%%/etc/rc.d/%s" % self.rc_name) + ) + + def enable(self, instance_name=""): + try: + if self.rc_name in freebsd_dbus_consumers: + self._ensure_message_bus() + self._set_rcvars( + freebsd_kerberos_rc_programs.get(self.rc_name, {})) + self._set_rcvars( + freebsd_kerberos_rc_enables.get(self.rc_name, {})) + ipautil.run([paths.SBIN_SYSRC, "%s_enable=YES" % self.rc_enable_name]) + except ipautil.CalledProcessError: + pass + + def disable(self, instance_name=""): + try: + ipautil.run([paths.SBIN_SYSRC, "%s_enable=NO" % self.rc_enable_name]) + # Undo the extra rc.conf variables that enable() set for the + # Kerberos services (kdc_program/kadmind_program and their + # *_enable flags) so an uninstall leaves no stale rc.conf + # entries behind. + for key in freebsd_kerberos_rc_enables.get(self.rc_name, {}): + ipautil.run([paths.SBIN_SYSRC, "%s=NO" % key]) + for key in freebsd_kerberos_rc_programs.get(self.rc_name, {}): + ipautil.run([paths.SBIN_SYSRC, "-x", key]) + except ipautil.CalledProcessError: + pass + + def is_enabled(self, instance_name=""): + try: + result = ipautil.run( + [paths.SBIN_SYSRC, "-n", "%s_enable" % self.rc_enable_name], + capture_output=True + ) + except ipautil.CalledProcessError: + return False + return result.output.strip().upper() == "YES" + + def install(self, instance_name=""): + self.enable(instance_name) + + def remove(self, instance_name=""): + self.disable(instance_name) + + +class FreeBSDOtpdService(base_services.PlatformService): + _START_TIMEOUT = 10.0 + _STOP_TIMEOUT = 10.0 + + @staticmethod + def _ensure_directory(directory): + try: + os.makedirs(directory, 0o755) + except OSError as error: + if error.errno not in (errno.EEXIST,): + raise + if not os.path.isdir(directory): + raise RuntimeError("%s is not a directory" % directory) + + @staticmethod + def _unlink(path): + try: + os.unlink(path) + except OSError as error: + if error.errno not in (errno.ENOENT,): + raise + + def _read_ldap_uri(self): + parser = RawConfigParser() + if not parser.read(paths.IPA_DEFAULT_CONF): + raise RuntimeError("Unable to read %s" % paths.IPA_DEFAULT_CONF) + if not parser.has_section("global"): + raise RuntimeError( + "Missing global section in %s" % paths.IPA_DEFAULT_CONF + ) + if not parser.has_option("global", "ldap_uri"): + raise RuntimeError( + "Missing ldap_uri in %s" % paths.IPA_DEFAULT_CONF + ) + ldap_uri = parser.get("global", "ldap_uri").strip() + if not ldap_uri or any(char.isspace() for char in ldap_uri): + raise RuntimeError( + "Invalid ldap_uri in %s" % paths.IPA_DEFAULT_CONF + ) + return ldap_uri + + def _write_inetd_config(self): + self._ensure_directory(os.path.dirname(paths.IPA_OTPD_INETD_CONF)) + self._ensure_directory(paths.IPA_OTPD_SOCKET_DIR) + ldap_uri = self._read_ldap_uri() + socket_spec = ":root:wheel:600:%s" % paths.IPA_OTPD_SOCKET + config_line = ( + "%s\tstream\tunix\tnowait\troot\t%s\tipa-otpd-wrapper %s\n" + % (socket_spec, paths.IPA_OTPD_WRAPPER, ldap_uri) + ) + temporary = paths.IPA_OTPD_INETD_CONF + ".tmp" + with open(temporary, "w") as config: + config.write(config_line) + config.flush() + os.fsync(config.fileno()) + os.chmod(temporary, 0o600) + os.rename(temporary, paths.IPA_OTPD_INETD_CONF) + + @staticmethod + def _read_pid_file(): + try: + with open(paths.IPA_OTPD_INETD_PID, "r") as pid_file: + pid = int(pid_file.read().strip()) + except (OSError, ValueError): + return None + if pid <= 1: + return None + return pid + + @staticmethod + def _command_matches(command): + required = ( + paths.SBIN_INETD, + paths.IPA_OTPD_INETD_PID, + paths.IPA_OTPD_INETD_CONF, + ) + return all(value in command for value in required) + + def _pid_command(self, pid): + result = ipautil.run( + [paths.BIN_PS, "-ww", "-p", str(pid), "-o", "command="], + capture_output=True, + raiseonerr=False + ) + if result.returncode: + return "" + return result.output.strip() + + def _find_pid(self): + pid = self._read_pid_file() + if pid is not None and self._command_matches(self._pid_command(pid)): + return pid + + result = ipautil.run( + [paths.BIN_PS, "-axww", "-o", "pid=", "-o", "command="], + capture_output=True, + raiseonerr=False + ) + if result.returncode: + return None + + for line in result.output.splitlines(): + fields = line.strip().split(None, 1) + if len(fields) < 2: + continue + try: + candidate = int(fields[0]) + except ValueError: + continue + if self._command_matches(fields[1]): + return candidate + return None + + @staticmethod + def _wait_until(predicate, timeout): + deadline = time.monotonic() + timeout + while time.monotonic() < deadline: + if predicate(): + return True + time.sleep(0.1) + return predicate() + + def _cleanup_runtime(self): + self._unlink(paths.IPA_OTPD_SOCKET) + self._unlink(paths.IPA_OTPD_INETD_PID) + self._unlink(paths.IPA_OTPD_INETD_CONF) + + def _stop_private(self): + pid = self._find_pid() + if pid is not None: + try: + os.kill(pid, signal.SIGTERM) + except OSError as error: + if error.errno not in (errno.ESRCH,): + raise + stopped = self._wait_until( + lambda: self._find_pid() is None, + self._STOP_TIMEOUT + ) + if not stopped: + raise RuntimeError("Unable to stop private ipa-otpd inetd") + self._cleanup_runtime() + + def _start_private(self, capture_output=True): + if self.is_running(wait=False): + return + if self._find_pid() is not None: + self._stop_private() + else: + self._cleanup_runtime() + self._write_inetd_config() + ipautil.run( + [ + paths.SBIN_INETD, + "-p", + paths.IPA_OTPD_INETD_PID, + paths.IPA_OTPD_INETD_CONF, + ], + skip_output=not capture_output + ) + started = self._wait_until( + lambda: self.is_running(wait=False), + self._START_TIMEOUT + ) + if not started: + self._stop_private() + raise RuntimeError("Unable to start private ipa-otpd inetd") + + def start(self, instance_name="", capture_output=True, wait=True): + self._start_private(capture_output=capture_output) + base_services.PlatformService.start( + self, instance_name, capture_output=capture_output, wait=wait + ) + + def stop(self, instance_name="", capture_output=True): + self._stop_private() + base_services.PlatformService.stop( + self, instance_name, capture_output=capture_output + ) + + def restart(self, instance_name="", capture_output=True, wait=True): + self._stop_private() + self._start_private(capture_output=capture_output) + + def try_restart(self, instance_name="", capture_output=True, wait=True): + if self._find_pid() is not None: + self.restart( + instance_name, capture_output=capture_output, wait=wait + ) + + def reload_or_restart(self, instance_name="", capture_output=True, + wait=True): + self.restart( + instance_name, capture_output=capture_output, wait=wait + ) + + def is_running(self, instance_name="", wait=True): + if self._find_pid() is None: + return False + try: + socket_status = os.stat(paths.IPA_OTPD_SOCKET) + except OSError: + return False + return stat.S_ISSOCK(socket_status.st_mode) + + def is_installed(self): + return all(os.path.isfile(path) for path in ( + paths.SBIN_INETD, + paths.IPA_OTPD, + paths.IPA_OTPD_WRAPPER, + )) + + def enable(self, instance_name=""): + pass + + def disable(self, instance_name=""): + pass + + def is_enabled(self, instance_name=""): + return False + + def install(self, instance_name=""): + pass + + def remove(self, instance_name=""): + pass + + +class FreeBSDDirectoryService(FreeBSDService): + def _instance_name(self, instance_name): + if instance_name: + return instance_name + realm = getattr(self.api.env, "realm", "") + if realm: + return realm.replace(".", "-") + return "" + + def _run_dsctl(self, instance_name, action, capture_output=True): + instance_name = self._instance_name(instance_name) + if not instance_name: + raise ValueError("Directory Server instance name is required") + # ns-slapd drops privileges in-process (root -> dirsrv), which makes + # MIT krb5 ignore KRB5_KTNAME from the environment (secure mode). + # Pass the DS keytab explicitly so ns-slapd's GSSAPI acceptor uses + # it (389-ds registers it via krb5_gss_register_acceptor_identity) + # instead of the unreadable default keytab. + env = dict(os.environ) + env["KRB5_KTNAME"] = paths.DS_KEYTAB + cmd = [paths.DSCTL, instance_name, action] + if action == "start": + # Give ns-slapd its own session. Started directly it inherits + # the process group of whatever runs us, and the SIGHUP that + # group receives when a subshell exits takes the Directory + # Server down again, e.g. in the middle of ipa-server-upgrade. + cmd = [paths.SBIN_DAEMON, "-f"] + cmd + ipautil.run( + cmd, + skip_output=not capture_output, + env=env + ) + return instance_name + + def _wait_until_running(self, instance_name, wait, ldapi): + if not wait: + return + # ns-slapd is started detached, so dsctl returns before the server + # is ready. Wait for its LDAPI socket in any case. + socket_name = paths.SLAPD_INSTANCE_SOCKET_TEMPLATE % instance_name + ipautil.wait_for_open_socket( + socket_name, self.api.env.startup_timeout + ) + if not ldapi and not self.is_running(instance_name, wait=False): + raise RuntimeError( + "Directory Server instance %s is not running" % instance_name + ) + + def start(self, instance_name="", capture_output=True, wait=True, + ldapi=False): + instance_name = self._instance_name(instance_name) + if not self.is_running(instance_name, wait=False): + self._run_dsctl(instance_name, "start", capture_output) + self._wait_until_running(instance_name, wait, ldapi) + base_services.PlatformService.start( + self, instance_name, capture_output=capture_output, wait=wait + ) + + def stop(self, instance_name="", capture_output=True): + instance_name = self._instance_name(instance_name) + if self.is_running(instance_name, wait=False): + self._run_dsctl(instance_name, "stop", capture_output) + base_services.PlatformService.stop( + self, instance_name, capture_output=capture_output + ) + + def restart(self, instance_name="", capture_output=True, wait=True, + ldapi=False): + instance_name = self._run_dsctl( + instance_name, "restart", capture_output + ) + self._wait_until_running(instance_name, wait, ldapi) + + def try_restart(self, instance_name="", capture_output=True, wait=True): + instance_name = self._instance_name(instance_name) + if self.is_running(instance_name, wait=False): + self.restart( + instance_name, capture_output=capture_output, wait=wait + ) + + def is_running(self, instance_name="", wait=True): + instance_name = self._instance_name(instance_name) + if not instance_name: + return False + result = ipautil.run( + [paths.DSCTL, "--json", instance_name, "status"], + capture_output=True, + raiseonerr=False + ) + if result.returncode != 0: + return False + try: + status = json.loads(result.output) + except (TypeError, ValueError): + return False + return isinstance(status, dict) and status.get("running") is True + + def is_installed(self, instance_name=""): + instance_name = self._instance_name(instance_name) + if not instance_name: + return False + instance_path = paths.ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE % instance_name + return os.path.isdir(instance_path) + + +def freebsd_service_class_factory(name, api=None): + if name == "dirsrv": + return FreeBSDDirectoryService(name, api) + if name == "ipa-otpd": + return FreeBSDOtpdService(name, api) + return FreeBSDService(name, api) + + +class FreeBSDServices(base_services.KnownServices): + def __init__(self): + import ipalib + + services = dict() + for service_name in base_services.wellknownservices: + services[service_name] = self.service_class_factory( + service_name, ipalib.api + ) + + super(FreeBSDServices, self).__init__(services) + + def service_class_factory(self, name, api=None): + return freebsd_service_class_factory(name, api) + + +timedate_services = base_services.timedate_services + +service = freebsd_service_class_factory +knownservices = FreeBSDServices() diff --git a/net/freeipa-server/files/patch-ipapython_ipautil.py b/net/freeipa-server/files/patch-ipapython_ipautil.py index 9649c574700b..0e5bd5a84a5d 100644 --- a/net/freeipa-server/files/patch-ipapython_ipautil.py +++ b/net/freeipa-server/files/patch-ipapython_ipautil.py @@ -1,22 +1,22 @@ --- ipapython/ipautil.py.orig 2026-07-16 09:44:00 UTC +++ ipapython/ipautil.py @@ -489,7 +489,7 @@ def run(args, stdin=None, raiseonerr=True, nolog=(), e if env is None: # copy default env env = copy.deepcopy(os.environ) - env["PATH"] = "/bin:/sbin:/usr/kerberos/bin:/usr/kerberos/sbin:/usr/bin:/usr/sbin" -+ env["PATH"] = "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin" ++ env["PATH"] = "/sbin:/bin:/usr/sbin:/usr/bin:%%LOCALBASE%%/sbin:%%LOCALBASE%%/bin" if stdin: p_in = subprocess.PIPE if skip_output: @@ -1368,7 +1368,9 @@ def wait_for_open_socket(socket_name, timeout=0): s.close() break except socket.error as e: - if e.errno in (2,111): # 111: Connection refused, 2: File not found + # ECONNREFUSED is 111 on Linux but 61 on FreeBSD, so compare + # against the symbolic values instead of hardcoded numbers. + if e.errno in (errno.ENOENT, errno.ECONNREFUSED): if timeout and time.time() > op_timeout: # timeout exceeded raise e time.sleep(1) diff --git a/net/freeipa-server/files/patch-ipaserver_install_cainstance.py b/net/freeipa-server/files/patch-ipaserver_install_cainstance.py index 3685347a545b..454935f7406d 100644 --- a/net/freeipa-server/files/patch-ipaserver_install_cainstance.py +++ b/net/freeipa-server/files/patch-ipaserver_install_cainstance.py @@ -1,60 +1,60 @@ --- ipaserver/install/cainstance.py.orig 2026-07-16 09:44:02 UTC +++ ipaserver/install/cainstance.py @@ -719,6 +719,9 @@ class CAInstance(DogtagInstance): def add_ipa_wait(self): """Add ipa-pki-wait-running to pki-tomcatd service """ + if paths.SYSTEMCTL is None: + return + conf = paths.SYSTEMD_PKI_TOMCAT_IPA_CONF directory = os.path.dirname(conf) if not os.path.isdir(directory): @@ -1608,7 +1611,7 @@ class CAInstance(DogtagInstance): return False logger.debug('Deploying ACME') - self._ldap_mod('/usr/share/pki/acme/database/ds/schema.ldif') -+ self._ldap_mod('/usr/local/share/pki/acme/database/ds/schema.ldif') ++ self._ldap_mod('%%LOCALBASE%%/share/pki/acme/database/ds/schema.ldif') configure_acme_acls() @@ -1643,7 +1646,7 @@ class CAInstance(DogtagInstance): ensure_acme_containers() # create ACME service instance - ipautil.run(['pki-server', 'acme-create']) + ipautil.run([paths.PKI_SERVER, 'acme-create']) # write configuration files sub_dict = dict( @@ -1661,7 +1664,7 @@ class CAInstance(DogtagInstance): self.service_user.chown(f.fileno()) # deploy ACME Tomcat application - ipautil.run(['pki-server', 'acme-deploy']) + ipautil.run([paths.PKI_SERVER, 'acme-deploy']) return True @@ -1918,7 +1921,7 @@ def minimum_acme_support(data=None): reading from the filesystem. """ if not data: - with open('/usr/share/pki/VERSION', 'r') as fd: -+ with open('/usr/local/share/pki/VERSION', 'r') as fd: ++ with open('%%LOCALBASE%%/share/pki/VERSION', 'r') as fd: data = fd.read() groups = re.match(r'.*\nSpecification-Version: ([\d+\.]*)\n.*', data) @@ -2080,9 +2083,9 @@ def __get_profile_config(profile_id): # Select UPGRADE version if we are in the 'updates' API context # and an upgrade-specific version of the profile exists. # - profile_filename = '/usr/share/ipa/profiles/{}.cfg'.format(profile_id) -+ profile_filename = '/usr/local/share/ipa/profiles/{}.cfg'.format(profile_id) ++ profile_filename = '%%LOCALBASE%%/share/ipa/profiles/{}.cfg'.format(profile_id) profile_upg_filename = \ - '/usr/share/ipa/profiles/{}.UPGRADE.cfg'.format(profile_id) -+ '/usr/local/share/ipa/profiles/{}.UPGRADE.cfg'.format(profile_id) ++ '%%LOCALBASE%%/share/ipa/profiles/{}.UPGRADE.cfg'.format(profile_id) if api.env.context == 'updates' and os.path.isfile(profile_upg_filename): profile_filename = profile_upg_filename diff --git a/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py b/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py index 19a9182c9d27..826397a9b0a8 100644 --- a/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py +++ b/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py @@ -1,43 +1,43 @@ --- ipaserver/install/server/upgrade.py.orig 2026-01-16 09:23:37 UTC +++ ipaserver/install/server/upgrade.py @@ -227,7 +227,7 @@ def check_certs(): else: logger.error("Missing Certification Authority file.") logger.error("You should place a copy of the CA certificate in " - "/usr/share/ipa/html/ca.crt") -+ "/usr/local/share/ipa/html/ca.crt") ++ "%%LOCALBASE%%/share/ipa/html/ca.crt") else: logger.debug('Certificate file exists') @@ -1136,9 +1136,9 @@ def ca_upgrade_schema(ca): # ACME schema file moved in pki-server-10.9.0-0.3 # ACME database connections were abstrated in pki-acme-10.10.0 for path in [ - '/usr/share/pki/acme/conf/database/ds/schema.ldif', - '/usr/share/pki/acme/conf/database/ldap/schema.ldif', - '/usr/share/pki/acme/database/ldap/schema.ldif', -+ '/usr/local/share/pki/acme/conf/database/ds/schema.ldif', -+ '/usr/local/share/pki/acme/conf/database/ldap/schema.ldif', -+ '/usr/local/share/pki/acme/database/ldap/schema.ldif', ++ '%%LOCALBASE%%/share/pki/acme/conf/database/ds/schema.ldif', ++ '%%LOCALBASE%%/share/pki/acme/conf/database/ldap/schema.ldif', ++ '%%LOCALBASE%%/share/pki/acme/database/ldap/schema.ldif', ]: if os.path.exists(path): acme_schema_ldif = path @@ -1148,8 +1148,8 @@ def ca_upgrade_schema(ca): return False schema_files=[ - '/usr/share/pki/server/conf/schema-certProfile.ldif', - '/usr/share/pki/server/conf/schema-authority.ldif', -+ '/usr/local/share/pki/server/conf/schema-certProfile.ldif', -+ '/usr/local/share/pki/server/conf/schema-authority.ldif', ++ '%%LOCALBASE%%/share/pki/server/conf/schema-certProfile.ldif', ++ '%%LOCALBASE%%/share/pki/server/conf/schema-authority.ldif', acme_schema_ldif, ] try: @@ -1671,6 +1671,7 @@ def upgrade_configuration(): FQDN=fqdn, AUTOREDIR='' if auto_redirect else '#', CRL_PUBLISH_PATH=paths.PKI_CA_PUBLISH_DIR, + USR_SHARE_IPA_DIR=paths.USR_SHARE_IPA_DIR.rstrip("/"), DOGTAG_PORT=8009, CLONE='#', WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR,